4 ms·
> almost all fail on point 2 unless the user does things that they almost never do Are you referring to the "scan this QR code to verify your partner's key" fu
by pbronez 6y ago
> almost all fail on point 2 unless the user does things that they almost never do
Are you referring to the "scan this QR code to verify your partner's key" function in secure messaging apps? I definitely use that. I try to keep all my primary contact's keys verified. It's harder during COVID when you're not meeting up in person as often, because anything besides meeting in person and verifying the two devices directly exposes you to another unverified channel.
It's very hard to bootstrap this stuff. Sure, "web of trust" but that's hard too. Speaking of which, didn't Keybase get bought by zoom to help with exactly these issues?
- upofadown 6y ago>Are you referring to the "scan this QR code to verify your partner's key" function in secure messaging apps? Yes. Or read the weird numbers/letters over the phone. Or look at the strange image and compare it somehow. For all I know there is something out there that wants you to compare a tune...
- DaiPlusPlus 6y agoThat still requires you to trust the client software. I trust Telegram’s E2E, but not Zoom - unless Zoom’s client is on GitHub with deterministic build steps?
- mr_mitm 6y agoTelegram's crypto is shoddy [1]. It may not be a complete train wreck, but if you value good crypto and privacy, Signal is probably your only option. It also offers E2EE group chats, unlike Telegram. [1] https://security.stackexchange.com/a/49802/29703 https://security.stackexchange.com/a/49802/29703 (a bit dated but AFAIK nothing changed)
- BlueTemplar 6y agoI guess that still need to trust Signal's centralized servers, located in the USA, to not give away your metadata ?
- upofadown 6y ago>a bit dated... A lot dated. The current thing is described here: * https://core.telegram.org/mtproto https://core.telegram.org/mtproto